SIP Registering softphone not receiving AUTH

[kako187]

HI, Suddenly I cannot register softphones via WAN anymore. I receive the REGISTER packet, the dialer sends the 401 UNAUTHORIZED packet, but I never see the AUTHORIZE packet after that. Everything works fine on LAN, I have tried turning off the firewall, I dont think it is a firewall issue or a port issue if I am receiving the REGISTER packets just fine? Please offer advice. Everything was fine before the weekend

Asterisk 11.25.1-vici
VICI VERSION: 2.14-678a
BUILD: 180613-0943
It was a vicibox install

<--- SIP read from UDP:my.ip.address.here:34994 --->
[Feb 3 12:16:29] REGISTER sip:dialer.ip.address.here;transport=UDP SIP/2.0
[Feb 3 12:16:29] Via: SIP/2.0/UDP my.ip.address.here:34994;branch=z9hG4bK-524287-1---f5b103a0ade27ecf;rport
[Feb 3 12:16:29] Max-Forwards: 70
[Feb 3 12:16:29] Contact: <sip:5040@my.ip.address.here:34994;rinstance=3f47f9791007a659;transport=UDP>
[Feb 3 12:16:29] To: <sip:5040@dialer.ip.address.here;transport=UDP>
[Feb 3 12:16:29] From: <sip:5040@dialer.ip.address.here;transport=UDP>;tag=637b5d7a
[Feb 3 12:16:29] Call-ID: udmQ0sL3_3oYoR5QFlHZgg..
[Feb 3 12:16:29] CSeq: 1 REGISTER
[Feb 3 12:16:29] Expires: 70
[Feb 3 12:16:29] Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
[Feb 3 12:16:29] Supported: replaces, norefersub, extended-refer, timer, outbound, path, X-cisco-serviceuri
[Feb 3 12:16:29] User-Agent: Z 5.2.28 rv2.8.115
[Feb 3 12:16:29] Allow-Events: presence, kpml, talk
[Feb 3 12:16:29] Content-Length: 0
[Feb 3 12:16:29]
[Feb 3 12:16:29] <------------->
[Feb 3 12:16:29] --- (14 headers 0 lines) ---
[Feb 3 12:16:29] Sending to my.ip.address.here:34994 (NAT)
[Feb 3 12:16:29] Sending to my.ip.address.here:34994 (NAT)
[Feb 3 12:16:29]
[Feb 3 12:16:29] <--- Transmitting (NAT) to my.ip.address.here:34994 --->
[Feb 3 12:16:29] SIP/2.0 401 Unauthorized
[Feb 3 12:16:29] Via: SIP/2.0/UDP my.ip.address.here:34994;branch=z9hG4bK-524287-1---f5b103a0ade27ecf;received=my.ip.address.here;rport=34994
[Feb 3 12:16:29] From: <sip:5040@dialer.ip.address.here;transport=UDP>;tag=637b5d7a
[Feb 3 12:16:29] To: <sip:5040@dialer.ip.address.here;transport=UDP>;tag=as2f60e7af
[Feb 3 12:16:29] Call-ID: udmQ0sL3_3oYoR5QFlHZgg..
[Feb 3 12:16:29] CSeq: 1 REGISTER
[Feb 3 12:16:29] Server: Asterisk PBX 11.25.1-vici
[Feb 3 12:16:29] Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
[Feb 3 12:16:29] Supported: replaces, timer
[Feb 3 12:16:29] WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="3d4a3231"
[Feb 3 12:16:29] Content-Length: 0
[Feb 3 12:16:29]
[Feb 3 12:16:29]
[Feb 3 12:16:29] <------------>
[Feb 3 12:16:29] Scheduling destruction of SIP dialog 'udmQ0sL3_3oYoR5QFlHZgg..' in 32000 ms (Method: REGISTER)
[Feb 3 12:16:30]
[Feb 3 12:16:30] <--- SIP read from UDP:my.ip.address.here:34994 --->
[Feb 3 12:16:30] REGISTER sip:dialer.ip.address.here;transport=UDP SIP/2.0
[Feb 3 12:16:30] Via: SIP/2.0/UDP my.ip.address.here:34994;branch=z9hG4bK-524287-1---f5b103a0ade27ecf;rport
[Feb 3 12:16:30] Max-Forwards: 70
[Feb 3 12:16:30] Contact: <sip:5040@my.ip.address.here:34994;rinstance=3f47f9791007a659;transport=UDP>
[Feb 3 12:16:30] To: <sip:5040@dialer.ip.address.here;transport=UDP>
[Feb 3 12:16:30] From: <sip:5040@dialer.ip.address.here;transport=UDP>;tag=637b5d7a
[Feb 3 12:16:30] Call-ID: udmQ0sL3_3oYoR5QFlHZgg..
[Feb 3 12:16:30] CSeq: 1 REGISTER
[Feb 3 12:16:30] Expires: 70
[Feb 3 12:16:30] Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
[Feb 3 12:16:30] Supported: replaces, norefersub, extended-refer, timer, outbound, path, X-cisco-serviceuri
[Feb 3 12:16:30] User-Agent: Z 5.2.28 rv2.8.115
[Feb 3 12:16:30] Allow-Events: presence, kpml, talk
[Feb 3 12:16:30] Content-Length: 0
[Feb 3 12:16:30]
[Feb 3 12:16:30] <------------->
[Feb 3 12:16:30] --- (14 headers 0 lines) ---
[Feb 3 12:16:30] Sending to my.ip.address.here:34994 (NAT)
[Feb 3 12:16:30]
[Feb 3 12:16:30] <--- Transmitting (NAT) to my.ip.address.here:34994 --->
[Feb 3 12:16:30] SIP/2.0 401 Unauthorized
[Feb 3 12:16:30] Via: SIP/2.0/UDP my.ip.address.here:34994;branch=z9hG4bK-524287-1---f5b103a0ade27ecf;received=my.ip.address.here;rport=34994
[Feb 3 12:16:30] From: <sip:5040@dialer.ip.address.here;transport=UDP>;tag=637b5d7a
[Feb 3 12:16:30] To: <sip:5040@dialer.ip.address.here;transport=UDP>;tag=as2f60e7af
[Feb 3 12:16:30] Call-ID: udmQ0sL3_3oYoR5QFlHZgg..
[Feb 3 12:16:30] CSeq: 1 REGISTER
[Feb 3 12:16:30] Server: Asterisk PBX 11.25.1-vici
[Feb 3 12:16:30] Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
[Feb 3 12:16:30] Supported: replaces, timer
[Feb 3 12:16:30] WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="3d4a3231"
[Feb 3 12:16:30] Content-Length: 0
[Feb 3 12:16:30]
[Feb 3 12:16:30]
[Feb 3 12:16:30] <------------>
[Feb 3 12:16:30] Scheduling destruction of SIP dialog 'udmQ0sL3_3oYoR5QFlHZgg..' in 32000 ms (Method: REGISTER)

[williamconley]

It was a vicibox install

Please include the full Vicibox installer version (helps us track down installer bugs seperately from Vicidial bugs).

has your IP address changed? (on either the server or the client ...)

what value do you have for /etc/asterisk/sip.conf "externip"? Does it match the public IP of the Vicidial server?

[kako187]

My IP has not changed and my extern_ip in sip.conf does match my external ip

[williamconley]

Is there a router in the router? Does your server have the public IP directly or does it travel through a router? If so, the router is likely in the way. Reboot it.

[kako187]

William, only one router. I tried rebooting the router first. No help. After the second reboot of the dialer, it is registering SIP phones again. I do not understand what the problem was in the first place, or why the first reboot did not fix it.

[williamconley]

William, only one router. ...

You say that like one router means the router couldn't be the problem. Routers are notorious for "deciding" that traffic is bad based on some engineer's understanding from 2004 when the SIP algorithm in some of these routers was being conceived.

It's possible that the router had nothing to do with the problem, or that rebooting the server after rebooting the router resolved the issue OR that the problem was on the dialer itself and you needed some patience for a process to begin properly.

All that being said: We *highly* recommend that servers have their own Public IP (NOT through a router at all) and that you use the iptables firewall in the Vicidial server in a whitelisted configuration. This really does remove "firewall" from the problem. It also removes a need for a STUN server and/or NAT translation (which tends to confuse and complicate SIP traffic in the first place).

Another solution for agents using soft phones out of the office is to use an IAX phone instead of a SIP phone. No NAT required, single port for control and audio.

[kako187]

William, my first thought was the router. Yes i have had trouble with SIP ALG on different routers so am familiar with engineer's putting their two cents in. I did try a known working IAX extension, with the same result as well. It would send registration packet, dialer would ask for auth, and the softphone would just repeat sending register packets. Tried from two external computers on two different networks. I would also like to take a minute to thank you for all your help. Not just with this thread but all the others. When I am reading through the forum I always find your replies and mflorell's most helpful.

[williamconley]

You just clearly explained why we recommend NO router be involved. Having a router means battling "router problem? firewall? cable? moon phase? ... all that goes away when the Vicidial server has a public IP being consumed with NO router. And then problems like this pretty much stop happening. When they DO happen, you turn off the firewall (which is not technically possible when you have a router ... which MUST use NAT and that can not be turned off at all).